CVE-2026-107717: Chat Role Injection and Prompt Boundary Bypass in Banks Library

Vulnerability ID: CVE-2026-107717
CVSS Score: 6.5
Published: 2026-10-08

CVE-2026-107717 represents a critical prompt boundary bypass and chat role injection vulnerability in the Banks Python package (versions prior to 2.5.0). The library parses generated template outputs line-by-line, attempting to validate each segment as a JSON-serialized ChatMessage object without validating the source boundaries of the text. If an application integrates user input directly into a prompt template, a remote, unauthenticated attacker can supply multi-line inputs with structured JSON payloads. This input is then parsed as high-privilege system instructions or tool execution responses, completely hijacking downstream Large Language Model behavior.

TL;DR

Unauthenticated remote attackers can inject newline characters and structural JSON payloads into dynamic template inputs to spoof high-privilege chat roles (such as 'system' or 'assistant') in Banks < 2.5.0, entirely bypassing application prompt protections.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-20
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 6.5
  • Impact Type: Prompt Boundary Bypass / Chat Role Injection
  • Exploit Status: Proof-of-Concept (PoC) documented
  • CISA KEV Status: Not Listed

Affected Systems

  • banks PyPI package prior to version 2.5.0
  • banks: < 2.5.0 (Fixed in: 2.5.0)

Code Analysis

Commit: 02172b8

Implement cryptographic sentinel validation to isolate template control structures from raw user data.

Exploit Details

Mitigation Strategies

  • Upgrade the banks PyPI library to version 2.5.0 or above.
  • Scrub all user inputs of newlines and carriage return characters before dynamic interpolation.
  • Enforce boundary validation rules on downstream LLM interfaces to detect unusual message role shifts.

Remediation Steps:

  1. Run 'pip install --upgrade banks>=2.5.0' to update the local environments.
  2. Verify setup.py, requirements.txt, or pyproject.toml specifications restrict banks to secure versions.
  3. Add validation logic to discard brackets and structural symbols from dynamic variables.

References

Read the full report for CVE-2026-107717 on our website for more details including interactive diagrams and full exploit analysis.